malicious_model.zip is a DL4J-style model ZIP archive containing an objects/myLabels entry whose bytes are a raw Java-serialized ysoserial CommonsCollections5 gadget chain (touch /tmp/pwned).

org.deeplearning4j.util.ModelSerializer.getObjectFromFile(File, String) — the public, documented API paired with addObjectToFile(File, String, Object) for storing/retrieving arbitrary auxiliary objects (e.g. class labels) inside a DL4J model ZIP — reads the named entry straight into ObjectInputStream.readObject() with zero type validation:

The only validation is a check that key isn't one of a handful of reserved internal names — there's no restriction on what class gets deserialized. Calling getObjectFromFile(malicious_model.zip, "myLabels") executes the gadget chain's payload; the call even "succeeds" without throwing (the generic <T> unchecked cast swallows the type mismatch).

This is a distinct, previously-undisclosed sink — not the same code path as the already-published CVE-2025-53001 (GHSA-wfhj-v5g7-vr7g), which covers only ModelSerializer.restoreMultiLayerNetwork() / the PREPROCESSOR_BIN ZIP entry. getObjectFromFile/addObjectToFile is a different, generic public API with no mention in that advisory.

commons-collections:3.2.1 must be on the victim's classpath for the CC5 gadget to fire (a common, often-transitive dependency in Java ML/data pipelines).

Confirmed against the current GitHub master branch (deeplearning4j/deeplearning4j, deeplearning4j-nn module).

Reported to huntr.com as a Model File Vulnerability (MFV) submission ("DL4J" format).